| # Licensed to the Apache Software Foundation (ASF) under one | |
| # or more contributor license agreements. See the NOTICE file | |
| # distributed with this work for additional information | |
| # regarding copyright ownership. The ASF licenses this file | |
| # to you under the Apache License, Version 2.0 (the | |
| # "License"); you may not use this file except in compliance | |
| # with the License. You may obtain a copy of the License at | |
| # | |
| # http://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, | |
| # software distributed under the License is distributed on an | |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | |
| # KIND, either express or implied. See the License for the | |
| # specific language governing permissions and limitations | |
| # under the License. | |
| # | |
| LISTEN_PORT=5000 | |
| COUCHDB_SERVICE_PORT=5984 | |
| COUCHDB_SERVICE_HOST=host.docker.internal | |
| COUCHDB_ADMIN_USER=whisk_admin | |
| COUCHDB_ADMIN_PASSWORD= | |
| KUBERNETES_SERVICE_HOST=host.docker.internal | |
| KUBERNETES_SERVICE_PORT=56490 | |
| KUBERNETES_TOKEN_FILENAME=./tokens/token | |
| KUBERNETES_CERT_FILENAME=./tokens/ca.crt | |
| # registry to use (ghcr or dockerhub or apache) | |
| # if not set, the image is build with local tag and will not be pushed | |
| REGISTRY= | |
| # namespace is required if REGISTRY is set | |
| NAMESPACE= | |
| REGISTRY_HOST=http://127.0.0.1:5000 | |
| REGISTRY_USER=opsuser | |
| REGISTRY_PASS=password | |
| ADMIN_API_URL=http://127.0.0.1:5002 | |
| # --- OIDC integration (see docs/OIDC.md) --- | |
| # Issuer URL of the OIDC realm (required). Also used to derive the device | |
| # authorization and token endpoints unless overridden below. | |
| OIDC_ISSUER_URL=https://keycloak.example.com/realms/openserverless | |
| # JWKS endpoint used to verify the access token signature (required) | |
| OIDC_JWKS_URL=https://keycloak.example.com/realms/openserverless/protocol/openid-connect/certs | |
| # Expected audience ("aud" claim) of the access token (required) | |
| OIDC_AUDIENCE=openserverless | |
| # Client id used for the device and password grant flows (defaults to OIDC_AUDIENCE) | |
| # OIDC_CLIENT_ID=openserverless | |
| # Client secret, only needed if the OIDC client is confidential | |
| OIDC_CLIENT_SECRET= | |
| # Claim used as the external username (default: preferred_username) | |
| OIDC_USERNAME_CLAIM=preferred_username | |
| # Claim to use directly as the namespace, when present and valid | |
| OIDC_NAMESPACE_CLAIM= | |
| # Claim holding the user's group memberships (default: groups) | |
| OIDC_GROUPS_CLAIM=groups | |
| # If set, tokens without this group are rejected with 403 | |
| OIDC_REQUIRED_GROUP= | |
| # Clock skew tolerance in seconds applied to exp/nbf validation (default: 30) | |
| OIDC_CLOCK_LEEWAY_SECONDS=30 | |
| # Provider name recorded on auto-provisioned WhiskUsers (default: keycloak) | |
| OIDC_PROVIDER=keycloak | |
| # Device Authorization endpoint (default: ${OIDC_ISSUER_URL}/protocol/openid-connect/auth/device) | |
| # OIDC_DEVICE_AUTHORIZATION_URL= | |
| # Token endpoint used by the device and password flows (default: ${OIDC_ISSUER_URL}/protocol/openid-connect/token) | |
| # OIDC_TOKEN_URL= | |
| # Scope requested when starting a device flow (default: openid email profile) | |
| OIDC_DEVICE_SCOPE=openid email profile | |
| # Scope requested for the password grant (default: openid email profile) | |
| OIDC_PASSWORD_SCOPE=openid email profile | |
| # Keep the external username as namespace when it is already a valid namespace (default: true) | |
| SSO_NAMESPACE_PRESERVE_VALID=true | |
| # Length of the collision-avoidance hash suffix appended to normalized namespaces (default: 8, clamped 6-16) | |
| SSO_NAMESPACE_HASH_LENGTH=8 | |
| # Maximum length of a generated namespace (default: 61, clamped 13-61) | |
| SSO_NAMESPACE_MAX_LENGTH=61 | |
| # Create a WhiskUser automatically on first successful OIDC login (default: false) | |
| SSO_AUTOPROVISION_ON_LOGIN=false | |
| # When set to "all", enables redis/mongodb/postgres/object-storage/milvus on the provisioned WhiskUser (default: all) | |
| SSO_AUTOPROVISION_DEFAULT_SERVICES=all | |
| # Object-storage quota assigned to auto-provisioned users (default: auto) | |
| SSO_AUTOPROVISION_STORAGE_QUOTA=auto | |
| # How long (seconds) admin-api waits for the provisioned namespace metadata to appear (default: 120) | |
| SSO_AUTOPROVISION_TIMEOUT_SECONDS=120 | |
| # Poll interval (seconds) while waiting for provisioning to complete (default: 2) | |
| SSO_AUTOPROVISION_POLL_SECONDS=2 |